XF.Classic — Office (OLE) malware analysis

Static analysis result for SHA-256 b75e7879899bdcd1…

MALICIOUS

Office (OLE)

51.0 KB Created: 2002-10-09 07:43:31 Authoring application: Microsoft Excel
MD5: 755aa52ff73e3ed83168a949e970694e SHA-1: 028af648aed81227e663f2b9373e4a80fd6de1af SHA-256: b75e7879899bdcd16ce4f61686f814a0c7fe6ea3c3ce957167aa0da86e51067f
60 Risk Score

Malware Insights

XF.Classic · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic for Applications

The heuristic firing 'OLE_XLS_FORMULA_MACRO_VIRUS' explicitly identifies this as a legacy Excel formula macro virus, specifically mentioning 'XF.Classic' and 'Poppy by VicodinES'. The document body contains strings like 'An Excel Formula Macro Virus (XF.Classic)' and 'Add New Workbook, Infect It, Save It As Book1.xls', confirming its intent to infect other Excel files and save them as 'Book1.xls' in the startup directory. This indicates a classic macro-based infection and potential payload delivery mechanism.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.